Spreadsheet compliance issues 218

  • I have another question relating to this topic, what is the consensus on an absolute deadline? Is it November 30, or does anyone have a deadline that is later than that?

  • The deadline is the end of your fiscal year ending after Nov 15, 2004. If you are not finished by then, you will have to evaluate the control deficiencies that you have in order to determine whether or not you can assert that internal controls over financial reporting (ICOFR) are effective.
    Not all deficiencies will need to be remediated by your year end for a clean assertion, especially if the ineffective controls are migitaged by other effective controls. The year-end assertion as to effectiveness is made based on your entire ICOFR structure.

  • One way to address Spreadsheet compliance issue is to have an electronic repository from where users check in and check out spreadsheets, this allows for version control for each time spreadsheet file is checked out, reason for the changes, who made the change, and what the changes were, along with electronic signature.
    Take a look at the Excel Version Control System software. Here is the link: 21cfrpart11compliance.com/VCS/evcs00.htm
    There is a similiar product for MS Word as well.
    Lou Gustav

  • Hey Everybody,
    Thanks for the input. I saw the PWC whitepaper, my supervisor had already modeled our approach after it.
    I’ll check out the link for the version control software. Thanks
    I had looked at the Beta XLSpell product that gives some pretty in-depth statistics on a speadsheet. Takes forever to run on even one spreadsheet and gets a lot of ‘false-positive’ hits but it was kinda impressive.
    I personnally believe some of these controls on spread sheets are unneccessary. The PWC whitepaper makes it sound like ‘spreadsheet hell’, but imagine what it was like before spreadsheets? I do. There were just as many errors made by accountants on 10-key adding machines as are made on spreadsheets now. The medium is changing, the problems are basicly the same. The same internal control we used back then (double checking someone else’s work and reasonableness reviews) are more likely to catch billion dollar errors like mentioned in the PWC report.
    I do support using spreadsheets as a guide to identifiying risks in calculation errors, but getting too detailed will never be a solution. It’s just too much.
    OK, thanks for listening, I’ll get off my soapbox.

  • Another option for managing your spreadsheets (and other document types) that is more generic then the Excel EVCS product is Microsoft’s SharePoint product. You get the same capability as EVCS plus a lot more.
    In addition, the company that I work for we have helped financial institututions develop solutions around this problem space using off the shelf solutions like Microsoft’s SharePoint product.

    • Tony

  • Also, don’t forget to question whether the spreadsheet is truly the most appropriate way of doing things. In many cases we should be looking for core business systems to be remediated to produce accounting data without the need for manipulation in Excel.

  • Do you have to go in a check your ‘major’ spreadsheets for accuracy and such? I read the PwC and it just speaks to the controls (access and such) over spreadsheets; however, we use spreadsheets for making material accruals every period. How can you get a correlation between saying a control over a process is effective when a spreadsheet is the most important part of the process, without testing the spreadsheet for set-up, mathmatical accuracy and such?
    Sorry, if this should be an easy question…but I was just thrown in to help at the end…and have some various questions.

  • There are two things that the PwC paper covers:

    1. What spreadsheets do you need to look at - this is a function of how complex are they and how important are they to the financial statements.
    2. What controls do you need - which is covered by ‘Determine the necessary level of controlfor the spreadsheet’. Testing the spreadsheet is covered under Development Lifecycle and Logic Inspection. Some support is provided by analytics.
      Be aware that there are also several spreadsheet auditing tools out there that can help identify potential logic issues for complex spreadsheets.

  • One should try to reduce significantly the spreadsheets in scope.
    To do so you like to only look at spreadsheets which have a direct impact on your financial statements, disclosures. E.g. if you do IFRS / GAAP adjustments, asset validation, footnotes etc. in Excel. Then you start to apply the PWC Paper.
    There’s a second group of spreadsheets which is used to transport or convert data automatically into other systems. E.g. for Batch Input in SAP. These should already be covered by General IT Controls.
    I definetly wouldn’t look at Spreadsheets which are used as a key control. E.g. using XL for reconsolidation. That would be something like a control over a control. The key control is already documented…
    Everything else would take away the reasons for using excel. The individual flexibility.
    This is despite the question if Excel is right tool to prepare in significant parts your financial statements. You may like to replace those parts of your financial statement process with something more appropriate. 😄

  • There’s a second group of spreadsheets which is used to transport or convert data automatically into other systems. E.g. for Batch Input in SAP. These should already be covered by General IT Controls.

    That might be a dangerous assumption.

  • No risk no fun… 😉

  • We were advised on Thursday or Friday that we should use Track Changes on our major Excel financial spreadsheets. Because you can’t change macros or delete sheets with Track Changes on I’ve had to copy and paste history worksheets, meaning that by today I have filled up the history worksheet (yes, 65536 rows). Surely SOX doesn’t require such a mass of data that no one can possibly check through.
    This is a key spreadsheet. It reads a dump of our main business system and picks up sub-totals etc. and produces a pretty set of accounts. But every time I download new data (several times a month) it tracks it as a change. Surely this is overkill. We as a business are becoming less and less competetive because of unreasonable demands on our time.

  • We were advised on Thursday or Friday that we should use Track Changes on our major Excel financial spreadsheets.
    I’d recommend instead looking at ‘Change Management’ or ‘Change Control’ versioning products that you could use on your server. For example, you’d checkout Workbook v1.0 of the spreadsheet, modify it, and check it back in as Workbook v2.0 (perhaps with an approver).
    I’m personally using this versioning controls for serval non-SOX compliant spreadsheets I publish. It provides backups, an audit trail and history of changes, and a great way of ensuring everyone is using the correct version of the document. In my own case, I’m not using Change Management software as it’s not required.
    Versioning using Change Management software is probably a more preferrable way of handling spreadsheet changes – just like you would program source code.

Log in to reply